My ssh keys are oldMany times I had the Idea to replace them and cleanup. Put the approach feels old not intuitive and i’m affraid of problems.

How do you manage keys and get sure they do ot get to old.

  • just_another_person@lemmy.worldEnglish
    21·
    14 hours ago

    This generally referred to as Key Rotation. It applies to everything from SSH keys, to API keys in running apps.

    There are automated ways to do this with ease, but it’s very simple to do with a single script, and some sort of secure key/value store (bitwarden, Vault, etcd…whatever).

    The process is basically something like:

    1. Create a script that runs on cron to check for a key at your k/v store at an expected location, like /ssh_keys/host1-private-12.1.25 and /ssh_keys/host1-public-12.1.25
    2. Deploy this script to all machines you wish to regularly rotate keys on and ensure running properly
    3. Generate new keys and put them in your k/v store at some versioned location/path like /ssh_keys/host1-private-12.21.25 and /ssh_keys/host1-pub-12.21.25
    4. Update your local script that regularly grabs these updated keys to point to the new version uploaded, bonus if your store can symlinkto some other locations like /ssh_keys/host1-private-current
    5. Wait X period of time to ensure all hosts get whatever key they need

    Your script can clear the old keys if needed but simply validating them in the access change serves the same effect. Up to you.